{"id":"CVE-2021-20180","published":"2022-03-16T14:12:30Z","modified":"2024-08-03T17:30:07Z","title":"A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by…","vendor":null,"product":null,"tier":"tail","description":{"text":"A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00314,"percentile":0.24293,"provenance":"source"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1915808","tags":["x_refsource_MISC"]}],"priority":{"score":4.9,"factors":[{"name":"EPSS percentile","points":4.86}]},"affectedVersions":[{"vendor":"n/a","product":"Ansible","versions":["Fixed in ansible 2.9.18"]}],"affected":[{"ecosystem":"PyPI","package":"ansible","vulnerableRanges":[">=2.8.0a1, <2.8.19",">=2.9.0b1, <2.9.18"],"patched":["2.8.19","2.9.18"],"from":["GHSA-fh5v-5f35-2rv2","PYSEC-2026-618"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1413","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ansible-cve-2021-20178","packageHistory":[{"cve":"CVE-2020-1735","published":"2020-03-16","fixed":"2.9.8","kev":false},{"cve":"CVE-2020-14365","published":"2020-09-23","fixed":"2.9.14rc1","kev":false},{"cve":"CVE-2021-20178","published":"2021-05-26","fixed":"2.9.18","kev":false},{"cve":"CVE-2021-20180","published":"2022-03-16","fixed":"2.9.18","kev":false},{"cve":"CVE-2021-3620","published":"2022-03-03","fixed":"2.9.27","kev":false},{"cve":"CVE-2020-10744","published":"2020-05-15","fixed":"2.10.0rc1","kev":false},{"cve":"CVE-2020-1734","published":"2020-03-03","fixed":"2.10.0rc1","kev":false},{"cve":"CVE-2021-20191","published":"2021-05-26","fixed":"2.10.7","kev":false,"link":{"from":"CVE-2021-20191","to":"CVE-2021-20180","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.8.19rc1","toFixed":"2.8.19","daysApart":294},{"kind":"similar","provenance":"machine","score":0.5,"basis":"same package + description similarity"}]}}],"package":"PyPI:ansible"}}